Domain exclusion lists for brand safety
Brand safety policies are written in words. Exclusion lists turn those words into a file of domains a buying platform can enforce.
This guide covers how to build that file from category data, how to keep it from blocking good inventory, and how to keep it current.
Start with the policy, then build the list
This page is about the list itself. The topics and risk levels behind it are covered in our other guides, so read those first if your policy is not settled yet.
Brand safety categories explained
Safety versus suitability, sensitive topic areas and risk tiers.
Brand safety in advertising
How advertisers and platforms apply URL categories to protect brands.
Made for advertising sites
What MFA sites are and the signals used to screen them out.
Parked domain detection
Why parked and for-sale names waste spend and how to spot them.
The handoff: once your policy says which topics and risk levels a brand avoids, the steps below turn it into domains. Keep the policy and the list in the same folder so anyone can trace a blocked domain back to a rule.
A layered exclusion list
One flat list mixing every reason for blocking is hard to maintain. Splitting it into layers means each part has a clear owner, a clear source and its own update rhythm.
Malware, phishing and suspicious domains
Universal for every client. Built from the Malware / Phishing / Suspicious category and updated most often, because these domains appear and vanish quickly.
Content no brand wants
Adult, Hate/Discrimination and similar categories that almost every advertiser excludes. Shared across the whole account.
Parked, for-sale and made for advertising
Not dangerous, but poor value. Parked / For-Sale Domains plus your own MFA screening and invalid traffic findings.
Client specific topics
Gambling for a children's brand, Alcohol for a health client, competitor sites for a retailer. Different for each advertiser.
Results based removals
Domains with poor viewability, suspicious click patterns or no conversions over time. Owned by the trading team.
Upload view: for each campaign, merge the layers that apply into one file. The layers stay separate in your own systems so a change in one does not disturb the others.
Turning categories into domains
Category rules are the backbone of layers 1 to 4. The table shows which data fields feed each rule and the typical decision teams make.
| Rule | Field used | Typical action | Watch out for |
|---|---|---|---|
| Security risks | Web filtering category: Malware / Phishing / Suspicious | Block for all | Short lived domains, so refresh often |
| Adult content | Adult, Lingerie/Swimsuits/Intimate Apparel | Block Adult for all, intimate apparel per client | Fashion retailers may want the second |
| Gambling | Gambling | Per client | Sports news sites are not gambling sites |
| Weapons and violence | Weapons, Violence, Military | Per client | Military history and defence news |
| Drugs, alcohol, tobacco | Illegal Drugs, Alcohol, Tobacco | Per client | Health information about addiction |
| Anonymizers | VPN / Proxy / Anonymizers | Often blocked | Privacy news and reviews |
| Low value inventory | Parked / For-Sale Domains | Block for all | Domains that later launch real sites |
| Fine topic exclusions | IAB content categories, tiers 2 to 4 | Per client | Too broad a tier blocks good sites |
The full category set is on the web filtering categories page. A domain can carry several ranked categories, so decide whether a rule fires on the primary category only or on any category.
Primary category or any category?
This single choice changes the size of an exclusion list more than any other. It deserves an explicit decision per layer.
Fire on primary category
- Blocks sites whose main subject is the risky topic.
- Smaller list, less collateral damage.
- Good for suitability layers where context matters.
- May miss mixed sites where risky content is a smaller part.
Fire on any category
- Blocks any site that carries the topic at all.
- Larger list, stricter protection.
- Good for security and floor layers.
- Can block general publishers that cover the topic now and then.
Common setup: security and floor layers fire on any category, suitability layers fire on the primary category. That keeps the dangerous material out while leaving room for news and general interest sites.
Over-blocking and under-blocking
Both failures cost money. Over-blocking shrinks reach and raises prices, while under-blocking lets placements through that a brand would never approve.
Signs of over-blocking
- Campaigns fail to spend and bid prices rise.
- Major news publishers are missing from placement reports.
- Keyword style rules block sites about health, history or safety advice.
- The list grows every month and nothing ever leaves it.
Signs of under-blocking
- Placements appear on parked or for-sale domains.
- New domains with risky content show up weeks after launch.
- Client screenshots arrive before your own reports catch the issue.
- Lists were last rebuilt months ago.
The news problem in one paragraph
Blocking the News/Media category as a whole removes some of the most trusted, highest attention inventory on the web. A better approach is to keep news eligible, block specific domains that fail your quality bar, and use page level tools for individual sensitive stories.
Fitting the list into platform limits
A category based list can contain millions of domains. Buying platforms and ad servers often limit list size or slow down with very long lists, so plan for that from the start.
| Technique | How it works | Trade off |
|---|---|---|
| Rank by bid traffic | Keep the domains that actually appear in your bid requests at the top of the upload | Needs your own log data |
| Rank by popularity band | Prioritize domains in global and country popularity bands | Long tail risks drop off the upload |
| Rely on platform defaults | Let platform level safety settings handle broad categories, upload only your extra layers | Less control over what defaults include |
| Split per campaign | Upload only the layers each campaign needs | More files to manage |
| Pre-bid filtering in house | Check domains against the full local database before bidding | Requires engineering, but no list size limit |
Teams that run their own bidding or supply logic usually load the database locally and check every request. The trade offs are explained in URL categorization API vs database.
An upkeep routine that keeps the list honest
Exclusion lists decay in two directions: new risky domains are missing, and old entries no longer deserve to be blocked. A light routine fixes both.
Add new security risks
Pull newly registered domains that land in Malware / Phishing / Suspicious into layer 1. Weekly delta files cover most teams, daily files suit security heavy setups.
Review fresh placement reports
Look up unfamiliar domains in the domain category checker and move confirmed problems into the right layer.
Full category rebuild
Rerun the category rules against the refreshed data. Domains that changed category or stopped being parked leave the list automatically.
Policy review with each client
Confirm suitability layers still match the brand's wishes, and check reach lost to blocking.
Trace and fix
When a bad placement happens, find which layer should have caught it and fix the rule, not only the domain.
How new domains are reviewed and rechecked is explained in URL database update schedule and freshness, and newly registered domains as a dataset in the newly registered domains list.
Worked example: one agency, three clients
An invented agency shows how layers save work. It runs open web campaigns for a toy maker, a bank and a beer brand.
How the layers combine
- Layers 1 to 3 are shared by all three clients and rebuilt monthly, with weekly security additions.
- The toy maker adds Gambling, Dating, Alcohol, Tobacco, Weapons and Violence on any category, plus intimate apparel.
- The bank adds Cryptocurrency on the primary category only, because crypto news on general finance sites is acceptable.
- The beer brand adds sites aimed at young audiences using IAB categories for children's content, and removes Alcohol from its exclusions.
- Each campaign upload merges the shared layers with the client's own layer, ranked by the agency's bid traffic.
- When a toy campaign shows on a betting tips site, the team checks why: the site was categorized as Sports, so they add Gambling as any category and the rule now catches it.
Why it works: each client gets a list that fits its policy, and a fix to a shared layer protects everyone at once.
New domains: block, wait or allow?
Every day brings a large wave of newly registered domains: most are harmless, some are scams, and many have no content yet. Each team needs a stated policy for them.
Strict: block until categorized
- New domains stay excluded until they carry a category.
- Fits security heavy clients and children's brands.
- Costs very little reach, because new sites rarely carry real audiences.
- Needs daily or weekly data so good sites are released quickly.
Balanced: follow the rechecks
- New domains are judged on their first category and judged again after a week and a month.
- Domains that turn risky after launch move into the right layer.
- Fits most advertisers buying the open web.
- Pairs well with weekly delta files.
Why rechecks matter: many sites launch as a blank page and add content later, and some scam sites change content once traffic arrives. A single look on day one misses both.
Measuring what the list costs you
Every blocked domain removes some reach. Measuring that cost per layer keeps the conversation with clients grounded in numbers rather than fear.
Share of bids blocked
For each layer, count the bid requests it removes. A layer that blocks a large share needs a hard look.
Price effect
Compare cost per thousand impressions before and after a layer change. Heavy blocking often pushes prices up.
Quality publishers lost
Check which popular domains are blocked. If well known news sites appear, a rule is probably too wide.
Incidents prevented
Record unsafe placements caught by each layer during tests. This shows clients what the blocking buys them.
Common mistakes with exclusion lists
These patterns appear in many account audits. Each has a simple fix once it is spotted.
| Mistake | What happens | Fix |
|---|---|---|
| One giant list for every reason | Nobody knows why a domain is blocked or who can unblock it | Split into layers with owners |
| Keyword lists on domain names | Sites like a cancer charity or a history magazine get blocked | Use categories, not words in the name |
| Never removing entries | Domains that changed hands or topic stay blocked forever | Rebuild category layers monthly |
| Copying another team's list | Rules meant for another brand cut your reach | Share only the universal layers |
| Ignoring subdomain matching | Blocks miss subdomains, or block far more than planned | Test platform matching with a few entries |
| No record of manual edits | Fixes disappear in the next rebuild | Keep manual additions in their own file |
Exclusion and inclusion working together
Sensitive brands often run an inclusion list for core campaigns and an exclusion list for wider reach. The same data and the same safety layers serve both.
Exclusion only
Wide reach with known risks removed. Suits performance and awareness campaigns that need scale.
Inclusion only
Hand picked topics, smaller reach. Suits regulated products and sponsorship style buys.
Both
Build the inclusion list from categories, then subtract the shared exclusion layers before upload.
Learn the other half
Our guide to domain inclusion lists for contextual campaigns covers building allow lists step by step.
Questions to settle before the first build
A short meeting before the first build saves weeks of back and forth later. Agree on these points with the client or brand team and write the answers into the rule sheet.
Which topics are off limits?
List them in plain words first, then map each one to web filtering or IAB categories together.
How strict per topic?
Decide topic by topic whether a rule fires on the primary category or on any category a site carries.
Which markets?
Rules can differ by country, for example where gambling or alcohol advertising rules differ.
What about news?
Agree in advance how news publishers are treated, so a sensitive headline does not trigger a blanket block.
Who can change the list?
Name the people allowed to add or remove domains by hand, and where they record the reason.
How is reach reported?
Agree which numbers the client sees each month, such as share of bids blocked per layer.
Documenting the list for clients and auditors
Brand safety questions usually arrive after something went wrong. A short record next to each list makes the answer quick and calm.
| Record | What it contains | Who reads it |
|---|---|---|
| Policy summary | The topics and risk levels the client avoids, in plain words | Client, account team |
| Rule sheet | Categories per layer, primary or any category, countries | Trading team, auditors |
| Build log | Date of each rebuild and data snapshot used | Ad operations |
| Manual changes | Domains added or removed by hand, with the reason | Everyone |
| Reach check | Share of bid traffic blocked by each layer | Client, planners |
Licence note: uploading derived block lists to your buying platforms is normal use. Publishing or reselling the underlying category data is not, see the licensing page.
Frequently asked questions
What is a domain exclusion list?
A block list naming the websites where a campaign must not appear. Everything else stays eligible, so reach stays wide.
How is it different from brand safety categories?
Categories describe sensitive topics. The exclusion list is the concrete set of domains you block after applying category, client, quality and performance rules.
How big should an exclusion list be?
Category based lists can reach millions of domains, more than some platforms accept. Keep the full list locally and upload a version ranked by bid traffic.
Does blocking news hurt reach?
Yes, blocking all news removes trusted, high attention inventory. Block specific domains and use page level tools for sensitive stories instead.
How often should it be updated?
Weekly additions for new risky domains plus a monthly full rebuild suits most teams. Check before every major campaign too.
Can I share one list across all clients?
Share the security, floor and quality layers. Add a client specific suitability layer for the topics each brand avoids.
What does the database provide for this?
Over 120 million domains with web filtering and IAB categories, country and popularity bands, including parked and malware categories. See the database.
Build block lists you can explain
Web filtering and IAB categories, country and popularity bands for over 120 million domains, with parked and malicious domains labelled. Delivered as files with a lookup API included.
See plans and pricing Inside the database [email protected]IAB is a trademark of the Interactive Advertising Bureau, named here only to identify the content taxonomy discussed. URL Categorization Database is not affiliated with, sponsored or endorsed by the Interactive Advertising Bureau.